docs: def authenticate_account(self, identifiers, authc_token, second_factor_token=None):
          """
          :type identifiers: SimpleIdentifierCollection or None
  
          :returns: account_id (identifiers) if the account authenticates
          :rtype: SimpleIdentifierCollection
          """
          msg = ("Authentication submission received for authentication "
                 "token [" + str(authc_token) + "]")
          logger.debug(msg)
  
          # the following conditions verify correct authentication sequence
          if not getattr(authc_token, 'identifier', None):
              if not identifiers:
                  msg = "Authentication must be performed in expected sequence."
                  raise InvalidAuthenticationSequenceException(msg)
              authc_token.identifier = identifiers.primary_identifier
  
          # add token metadata before sending it onward:
          authc_token.token_info = token_info[authc_token.__class__]
  
          try:
              account = self.do_authenticate_account(authc_token)
              if (account is None):
                  msg2 = ("No account returned by any configured realms for "
                          "submitted authentication token [{0}]".
                          format(authc_token))
  
                  raise AccountException(msg2)
  
          except AdditionalAuthenticationRequired as exc:
              if second_factor_token:
                  return self.authenticate_account(exc.account_id, second_factor_token, None)
  
              self.notify_event(authc_token.identifier, 'AUTHENTICATION.PROGRESS')
              raise exc  # the security_manager saves subject identifiers
  
          except AccountException:
              self.notify_event(authc_token.identifier,
                                'AUTHENTICATION.ACCOUNT_NOT_FOUND')
              raise
  
          except LockedAccountException:
              self.notify_event(authc_token.identifier, 'AUTHENTICATION.FAILED')
              self.notify_event(authc_token.identifier, 'AUTHENTICATION.ACCOUNT_LOCKED')
              raise
  
          except IncorrectCredentialsException as exc:
              self.notify_event(authc_token.identifier, 'AUTHENTICATION.FAILED')
              self.validate_locked(authc_token, exc.failed_attempts)
              # this won't be called if the Account is locked:
              raise IncorrectCredentialsException
  
          self.notify_event(account['account_id'].primary_identifier,
                            'AUTHENTICATION.SUCCEEDED')
  
          return account['account_id']